CVE-2018-7407

An issue was discovered in Foxit Reader before 9.1 and PhantomPDF before 9.1. This vulnerability allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when rendering U3D images inside of pdf files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this to execute code in the context of the current process.

• CWE-704

• http://www.securityfocus.com/bid/104300Third Party Advisory, VDB Entry
• https://srcincite.io/advisories/src-2018-0018/Third Party Advisory
• https://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory
• http://www.securityfocus.com/bid/104300Third Party Advisory, VDB Entry
• https://srcincite.io/advisories/src-2018-0018/Third Party Advisory
• https://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory

Published

May 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7365All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartVi…5.1
• CVE-2018-7366ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT…4.3
• CVE-2018-7367Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7368Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7405Cross-site scripting (XSS) in Zoho ManageEngine EventLog Ana…
• CVE-2018-7406An issue was discovered in Foxit Reader before 9.1 and Phant…
• CVE-2018-7408An issue was discovered in an npm 5.7.0 2018-02-21 pre-relea…
• CVE-2018-7409In unixODBC before 2.3.5, there is a buffer overflow in the …
• CVE-2018-7417In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the IPMI di…
• CVE-2018-7418In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP…
• CVE-2018-7419In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the NBAP di…
• CVE-2018-7420In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the pcapng …